From 01a44d620c1a85d61c29f0d1d41c62ec0c9178a7 Mon Sep 17 00:00:00 2001
From: big-kahuna-burger <11753867+big-kahuna-burger@users.noreply.github.com>
Date: Tue, 30 Jun 2026 23:53:36 +0200
Subject: [PATCH] fix: removes script injection sink in publish.yml by passing
 inputs.prefix through env instead of inline interpolation

---
 .github/workflows/publish.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c1e38823..2962ea6e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -41,7 +41,9 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Build and publish Python layer and Docker image
-        run: make python docker-python LAYER_NAME_PREFIX=${{ inputs.prefix }} ECR_REPO_PREFIX=${{ inputs.prefix }}
+        run: make python docker-python LAYER_NAME_PREFIX="$LAYER_PREFIX" ECR_REPO_PREFIX="$LAYER_PREFIX"
+        env:
+          LAYER_PREFIX: ${{ inputs.prefix }}
 
   deploy-node:
     name: Build and Publish Node.js
@@ -67,7 +69,9 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Build and publish Node.js layer and Docker image
-        run: make node docker-node LAYER_NAME_PREFIX=${{ inputs.prefix }} ECR_REPO_PREFIX=${{ inputs.prefix }}
+        run: make node docker-node LAYER_NAME_PREFIX="$LAYER_PREFIX" ECR_REPO_PREFIX="$LAYER_PREFIX"
+        env:
+          LAYER_PREFIX: ${{ inputs.prefix }}
 
   deploy-java:
     name: Build and Publish Java
@@ -90,7 +94,9 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Build and publish Java layer and Docker image
-        run: make java docker-java LAYER_NAME_PREFIX=${{ inputs.prefix }} ECR_REPO_PREFIX=${{ inputs.prefix }}
+        run: make java docker-java LAYER_NAME_PREFIX="$LAYER_PREFIX" ECR_REPO_PREFIX="$LAYER_PREFIX"
+        env:
+          LAYER_PREFIX: ${{ inputs.prefix }}
 
   deploy-manual:
     name: Build and Publish Manual
@@ -109,4 +115,6 @@ jobs:
           role-to-assume: ${{ vars.AWS_ROLE_ARN }}
           aws-region: ${{ inputs.region || vars.AWS_REGION }}
       - name: Build and publish Manual layer
-        run: make manual LAYER_NAME_PREFIX=${{ inputs.prefix }}
+        run: make manual LAYER_NAME_PREFIX="$LAYER_PREFIX"
+        env:
+          LAYER_PREFIX: ${{ inputs.prefix }}